Researchers Warn Of PamDOORa Backdoor Attacking Linux Systems

The report describes PamDOORa, a stealthy Linux persistence/backdoor that abuses the PAM pam_exec module to execute hidden scripts during SSH authentication (notably on failed logins), harvest environment variables (e.g., PAM_RHOST, PAM_SERVICE, PAM_USER) and exfiltrate them to attacker-controlled servers; the technique evades standard logs and detection, and the report recommends strict file integrity monitoring and Linux hardening.